PRIVACY POLICY — ENGINORA
Version 1.0
Effective date: September 1, 2026
This Privacy Policy explains how I AND YOO, publisher of the Enginora service, collects and processes personal data when a person:
- visits Enginora websites or services;
- creates or uses an Enginora Account;
- subscribes to a Plan;
- makes a payment;
- contacts Enginora;
- uses support;
- receives professional communications from Enginora.
It does not describe processing carried out by Enginora on behalf of its Clients within their projects. Such processing is governed by Enginora’s Data Processing Agreement (“DPA”).
1. DATA CONTROLLER
The controller for the processing described in this Policy is:
I AND YOO
French simplified joint-stock company (société par actions simplifiée) with share capital of EUR 3,000
105 avenue des Grésillons
92230 Gennevilliers
France
SIREN: 831 208 277
SIRET: 831 208 277 00028
RCS Nanterre
EU VAT number: FR59831208277
General contact: contact form
Contact for data protection and the exercise of rights:
2. WHAT DATA MAY WE PROCESS?
Depending on how a person uses Enginora, I AND YOO may process the following categories of data.
2.1 Account data
Including:
- last name;
- first name where provided;
- email address;
- Firebase technical identifier;
- information relating to the creation and status of the Account;
- authentication method;
- user or administrator role.
Enginora uses Firebase Authentication to manage user authentication.
The methods currently offered include authentication by email and password as well as Google OAuth.
3. SUBSCRIPTION AND BILLING DATA
When you subscribe to a paid Plan or purchase Credits, we may process in particular:
- identity and billing contact details;
- company;
- billing address;
- country;
- VAT number where provided;
- Stripe Customer identifier;
- subscription identifiers;
- subscribed Plan;
- subscription history;
- payment amounts and status;
- information relating to invoices and credit notes.
Payments are processed using Stripe.
Sensitive payment data required to process payment cards is processed by Stripe as part of its payment service.
Stripe publishes its own contractual data-protection framework and a Data Processing Agreement.
4. SUPPORT AND COMMUNICATION DATA
When you contact I AND YOO or use support functions, we may process in particular:
- your identity;
- your email address;
- your company;
- the content of your request;
- exchanges with our support service;
- technical information you choose to provide in order to resolve an issue.
Enginora currently uses, among other services, Tawk.to for certain support functions.
Tawk.to provides a data-processing framework and a DPA applicable to its service.
5. TECHNICAL AND SECURITY DATA
When the Service is used, certain technical data may be processed to ensure its operation, security and diagnosis.
This may include in particular:
- technical identifiers;
- access dates and times;
- authentication events;
- technical logs;
- error messages and information;
- project or operation identifiers;
- events relating to service operation;
- information necessary to prevent abuse, fraud or unauthorized access.
Certain data may be retained in the technical infrastructure used by Enginora, including Google Cloud and Firebase.
The GDPR recognizes that processing strictly necessary and proportionate for network and information-system security may be based on the controller’s legitimate interests.
5.1 Audience-measurement data
Where the user consents to audience measurement on the corporate website, Google Analytics 4 may process in particular:
- session and website-usage information;
- page-view and navigation events;
- approximate geolocation;
- browser and device information;
- interaction events that the enabled Enhanced Measurement configuration is technically able to detect, including page views, scrolls, outbound clicks, file downloads, video interactions and form interactions.
The actual detection of these events depends on the applicable technical conditions. Internal site-search measurement is disabled.
Enginora does not intend to transmit names, email addresses, telephone numbers or form contents to Google Analytics 4. User-provided data collection is disabled. Google Signals is disabled, advertising personalization is disabled, and no Google Ads integration is currently used.
6. DATA CONTAINED IN CLIENT PROJECTS
This situation must be distinguished from the processing described above.
Where personal data is contained in:
- a project context;
- a persona;
- guidelines;
- an analyzed page;
- a territory;
- metadata;
- a Draft;
- or any other Client Content,
and Enginora processes that data solely to provide the Service requested by its Client, the Client normally determines the purpose of the processing.
In this situation:
- the Client generally acts as controller, or as processor for its own client;
- I AND YOO acts as processor or subprocessor.
Such processing is governed by the Enginora DPA rather than principally by this Privacy Policy.
If you believe that your personal data appears in an Enginora project created by one of our Clients, we recommend that you first contact the organization that created the project.
You may also contact us at privacy@iandyoo.com so that we can direct you where reasonably possible.
7. WHY DO WE PROCESS YOUR DATA?
7.1 Creation and operation of the Account
Purposes:
- create and manage the Account;
- authenticate the user;
- provide access to the Service;
- manage Account settings;
- manage Plans and Credits.
Legal basis:
Where the user contracts directly with I AND YOO: performance of the contract or steps taken prior to entering into the contract.
Where the user acts on behalf of a Client organization: the legitimate interests of I AND YOO and the Client in enabling access to and use of the Service.
7.2 Corporate-website audience measurement
Purposes:
- measure the audience and use of the corporate website;
- compile navigation and interaction statistics;
- understand in aggregate how the website is used in order to assess its operation and content.
Legal basis:
The user’s consent. Google Analytics 4 is activated only after the corresponding Analytics consent has been obtained.
8. BILLING AND PAYMENTS
Purposes:
- manage subscriptions;
- process payments;
- issue and retain invoices;
- manage unpaid amounts;
- manage accounting and tax obligations.
Legal bases:
- performance of the contract;
- compliance with legal, accounting and tax obligations;
- legitimate interest relating to management and recovery of receivables where necessary.
Billing data that must be retained under accounting obligations may be retained for ten years, including after the end of the commercial relationship.
9. SUPPORT AND USER RELATIONSHIP
Purposes:
- respond to requests;
- handle incidents;
- provide assistance;
- follow up the relationship with users and Clients.
Legal bases:
- performance of the contract where the request concerns the Service;
- I AND YOO’s legitimate interest in responding to requests and improving the quality of its relationship with users.
10. SECURITY, FRAUD AND PROTECTION OF THE SERVICE
Purposes:
- secure Accounts;
- detect or prevent unauthorized access;
- diagnose incidents;
- ensure the integrity of the Service;
- prevent fraud and abuse;
- ensure the traceability necessary for technical operation.
Legal basis:
I AND YOO’s legitimate interest in protecting its Service, users and systems.
This interest is assessed taking into account the rights and reasonable expectations of the persons concerned.
11. LEGAL OBLIGATIONS AND DEFENCE OF RIGHTS
We may retain or process certain data where necessary to:
- comply with a legal obligation;
- respond to a competent authority;
- establish, exercise or defend legal rights;
- manage a dispute or claim.
The data concerned is then limited to what is necessary for that purpose.
12. B2B COMMERCIAL COMMUNICATIONS
I AND YOO may use the professional contact details of Clients or prospects to send them communications relating to Enginora where the applicable legal conditions are met.
For communications addressed to professionals, prospecting may in particular be based on legitimate interest where the message relates to the profession of the person contacted.
Any person may object easily and free of charge to commercial communications addressed to them.
Where an unsubscribe mechanism is offered in a communication, it may be used directly.
A request may also be sent to:
Data used for prospecting concerning a Client may, in accordance with CNIL recommendations, be retained during the commercial relationship and then for three years from its end.
Data relating to a prospect may be retained for three years from its collection or from the last contact initiated by the prospect.
Information strictly necessary to record an objection to prospecting may be retained in order to avoid contacting the person again. The CNIL recommends a minimum retention period of three years for this information.
13. WHO MAY RECEIVE YOUR DATA?
To the extent necessary for their functions, data may be accessible to:
- authorized persons within I AND YOO;
- technical service providers necessary for Enginora’s operation;
- hosting and authentication providers;
- the payment provider;
- support services;
- I AND YOO’s professional advisers where necessary;
- competent authorities where required by law.
The main services concerned include in particular:
Google Cloud / Firebase
Infrastructure and authentication.
OVHcloud
Hosting in France of the n8n orchestration used by Enginora.
Stripe
Payment, billing and subscription management.
Tawk.to
User support.
Google Analytics 4 (Google)
Corporate-website audience measurement and usage statistics, only after consent.
Where I AND YOO processes data on behalf of a Client, OpenAI, Anthropic and Perplexity may also be involved in the processing chain in accordance with the Enginora DPA.
14. INTERNATIONAL TRANSFERS
Certain providers used by I AND YOO may process data outside the European Economic Area.
Where an international transfer is subject to Chapter V GDPR, I AND YOO relies on an appropriate mechanism, such as:
- an adequacy decision of the European Commission;
- the European Commission’s Standard Contractual Clauses;
- or another mechanism permitted by the applicable regulations.
The data subject may request further information about the applicable safeguards by writing to:
The CNIL notes that the existence of a transfer outside the European Union and the associated safeguards must form part of the information provided to data subjects.
15. HOW LONG DO WE RETAIN DATA?
I AND YOO does not retain personal data for longer than necessary having regard to the purpose pursued.
Where the regulations impose a specific period, that period is applied.
Otherwise, the retention period is determined according to:
- the duration of the contractual relationship;
- the existence of the Account;
- the operational purpose;
- security needs;
- statutory limitation periods;
- applicable legal obligations.
In particular:
Account data
Retained for the lifetime of the Account and the relationship with the Client, after which, where necessary, certain information may be archived for the periods required to establish or defend I AND YOO’s rights.
Billing data
Documents and data that must be retained under accounting obligations may be retained for ten years.
Prospecting data
Retained for the periods described in Section 12.
Support data
Retained for the time necessary to handle the request and then, where justified, for a period allowing follow-up of the relationship or management of a potential dispute.
Logs and security data
Retained for a period proportionate to their purpose of security, diagnosis and prevention of abuse.
Google Analytics 4 data
Event-level and user-level data retention in Google Analytics 4 is configured for 14 months.
Backups
Where deleted data remains temporarily present in a technical backup, it is deleted in accordance with the normal rotation cycle applicable to that backup and is not used for ordinary processing.
The GDPR requires a retention period to be defined or, where an exact period is not possible, criteria enabling that period to be determined.
16. DELETION OF AN ACCOUNT
Complete deletion of an Enginora Account is not currently offered on a self-service basis.
A deletion request may be sent to:
I AND YOO may verify the identity and authority of the requester before carrying out a request affecting a professional Account.
Deletion is handled manually within a reasonable period.
Certain data may nevertheless continue to be retained where:
- retention is required by law;
- it is necessary to establish or defend a legal right;
- it remains temporarily present in a technical backup during its normal rotation cycle.
17. YOUR RIGHTS
Depending on the nature of the processing and its legal basis, you may have in particular:
- a right of access to your data;
- a right to rectification;
- a right to erasure;
- a right to restriction of processing;
- a right to object;
- a right to data portability where the legal conditions are met;
- the right to withdraw consent where processing is based on consent.
The rights that apply vary depending on the processing concerned and its legal basis.
The CNIL describes these rights and the conditions under which they may be exercised.
Export features and right to data portability
Enginora also offers features allowing Clients to retrieve certain data and Deliverables in exportable formats.
These contractual export and reversibility features are distinct from the right to data portability under Article 20 GDPR, whose scope and conditions are specific.
The existence of an export feature in Enginora therefore does not limit any rights a data subject may have under the GDPR. A request relating to those rights may be sent to privacy@iandyoo.com.
18. HOW TO EXERCISE YOUR RIGHTS
You may send your request to:
Your request must enable I AND YOO to sufficiently identify the data or Account concerned.
Where necessary to prevent unauthorized disclosure or deletion, I AND YOO may request information allowing it to reasonably verify the identity or authority of the requester.
19. COMPLAINT TO THE CNIL
If you consider that the processing of your personal data does not comply with the applicable regulations, you may lodge a complaint with the competent supervisory authority.
For processing under I AND YOO’s responsibility in France, the main supervisory authority is the Commission nationale de l’informatique et des libertés (CNIL).
20. AUTOMATED DECISIONS
For the processing described in this Policy, I AND YOO does not use personal data to make decisions about individuals that are based solely on automated processing and produce legal effects or similarly significantly affect them.
Enginora’s artificial-intelligence features are intended to assist professionals in producing recommendations and Drafts and do not make such decisions about users.
21. COOKIES AND OTHER TRACKERS
Enginora websites and services may use technical technologies necessary for their operation.
Where cookies or other trackers require prior consent under the applicable regulations, they must only be used after that consent has been obtained.
The CNIL requires in particular that users be able to accept, refuse and withdraw consent where consent is required.
Detailed information on the cookies and trackers used is provided through the information and choice mechanisms available on Enginora services.
On the corporate website, Google Analytics 4 is registered in the tarteaucitron consent manager through its built-in gtag service, with measurement ID G-7B8RLE8P5B.
The configuration applies strict Analytics consent: Google Analytics 4 does not load before consent, remains unloaded after refusal, and no cookieless Analytics signal is intentionally sent before consent or after refusal. Google Consent Mode keeps the relevant permissions denied by default until the corresponding consent is granted.
After consent, first-party Google Analytics cookies such as _ga and related GA identifiers may be created. The user may later withdraw consent through the Enginora cookie-management control. Google Analytics 4 is not presented as exempt from consent.
22. SECURITY
I AND YOO implements technical and organizational measures proportionate to the risks in order to protect personal data against in particular:
- unauthorized access;
- loss;
- alteration;
- unauthorized disclosure;
- accidental or unlawful destruction.
Measures applicable to processing carried out on behalf of Clients are also described in the Enginora DPA.
23. CHANGES TO THE POLICY
I AND YOO may amend this Privacy Policy, including to take account of:
- changes to the Service;
- changes to its processing activities;
- regulatory changes;
- changes to the providers used.
The published version states its effective date.
Where a change materially affects the conditions under which data is processed, appropriate information is provided to the persons concerned.
24. CONTACT
For any question concerning this Policy or the processing of personal data carried out by I AND YOO:
For contractual or general questions relating to Enginora:
End of the Enginora Privacy Policy — Version 1.0